Living-off-The-Land Reverse-Shell Detection by Informed Data Augmentation

arXiv:2402.18329v1 Announce Type: cross
Abstract: The living-off-the-land (LOTL) offensive methodologies rely on the perpetration of malicious actions through chains of commands executed by legitimate applications, identifiable exclusively by analysis of system logs. LOTL techniques are well hidden inside the stream of events generated by common legitimate activities, moreover threat actors often camouflage activity through obfuscation, making them particularly difficult to detect without incurring in plenty of false alarms, even using machine learning. To improve the performance of models in such …

abstract actors analysis applications arxiv augmentation cs.cr cs.lg data detection events generated hidden inside logs shell threat threat actors through type